- wlug - list.wlug.org.nz

Malware Uses WiFi BSSID for Victim Identification
by Peter Reutemann 05 Jan '21

05 Jan '21

'Malware operators who want to know the location of the victims they infect usually rely on a simple technique where they grab the victim's IP address and check it against an IP-to-geo database like MaxMind's GeoIP to get a victim's approximate geographical location. While the technique isn't very accurate, it is still the most reliable method of determining a user's actual physical location based on data found on their computer. However, in a blog post last month, Xavier Mertens, a security researcher with the SANS Internet Storm Center, said he discovered a new malware strain that is using a second technique on top of the first. This second technique relies on grabbing the infected user's BSSID. Known as a "Basic Service Set Identifier," the BSSID is basically the MAC physical address of the wireless router or access point the user is using to connect via WiFi. You can see the BSSID on Windows systems by running the command: netsh wlan show interfaces | find "BSSID" Mertens said the malware he discovered was collecting the BSSID and then checking it against a free BSSID-to-geo database maintained by Alexander Mylnikov.' -- source: https://it.slashdot.org/story/21/01/04/2042204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

free/open-source software...
by Peter Reutemann 04 Jan '21

04 Jan '21

Hi everyone Below are some free/open-source software projects that I've stumbled across over the Xmas break, which I hadn't heard of before but sound interesting: NATRON Open Source Compositing Software For VFX and Motion Graphics. https://natrongithub.github.io/ RawTherapee a free, cross-platform raw image processing program https://rawtherapee.com/ Lightworks For over 25 years Lightworks editor has been at the forefront of film editing, having been used on many of the finest films in cinema history: The Wolf of Wall Street, LA Confidential, Pulp Fiction, Heat, Road to Perdition, Hugo, The King’s Speech and many more! https://www.lwks.com/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Are We Experiencing a Great Software Stagnation?
by Peter Reutemann 04 Jan '21

04 Jan '21

'Long-time programmer/researcher/former MIT research fellow Jonathan Edwards writes a blog called "Alarming Development: Dispatches from the User Liberation Front." He began the new year by arguing that software "is eating the world. But progress in software technology itself largely stalled around 1996." Slashdot reader tonique summarizes Edwards' argument: In 1996 there were "LISP, Algol, Basic, APL, Unix, C, Oracle, Smalltalk, Windows, C++, LabView, HyperCard, Mathematica, Haskell, WWW, Python, Mosaic, Java, JavaScript, Ruby, Flash, Postgress [sic]". After that we're supposed to have achieved "IntelliJ, Eclipse, ASP, Spring, Rails, Scala, AWS, Clojure, Heroku, V8, Go, React, Docker, Kubernetes, Wasm". Edwards's main thesis is that the Internet boom around 1996 caused this slowdown because programmers could get rich quick. Then smart and ambitious people moved into Silicon Valley, and founded startups. But you can't do research at a startup due to time and money constraints. Today only "megacorps" like Google, Facebook, Apple and Microsoft are supposedly able to do relevant research because of their vast resources. Computer science wouldn't help, either, because "most of our software technology was built in companies" and because computer science "strongly disincentivizes risky long-range research". Further, according to Edwards, the aversion to risk and "hyper-professionalization of Computer Science" is part of a larger and worrisome trend throughout the whole field and all of western civilisation. Edwards' blog post argues that since 1996 "almost everything has been cleverly repackaging and re-engineering prior inventions. Or adding leaky layers to partially paper over problems below. Nothing is obsoleted, and the teetering stack grows ever higher..." "[M]aybe I'm imagining things. Maybe the reason progress stopped in 1996 is that we invented everything. Maybe there are no more radical breakthroughs possible, and all that's left is to tinker around the edges. This is as good as it gets: a 50 year old OS, 30 year old text editors, and 25 year old languages. "Bullshit. No technology has ever been permanent. We've just lost the will to improve."' -- source: https://developers.slashdot.org/story/21/01/03/0010225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Mozilla Is Working On a Firefox Design Refresh
by Peter Reutemann 04 Jan '21

04 Jan '21

'Mozilla is "investigating" a design refresh for its Firefox browser. Ghacks reports that the refresh is referred to internally as "Photon." Information about the design refresh is limited at this point in time. Mozilla created a meta bug on Bugzilla as a reference to keep track of the changes. While there are not any mockups or screenshots posted on the site, the names of the bugs provide information on the elements that will get a refresh. These are: - The Firefox address bar and tabs bar. - The main Firefox menu. - Infobars. - Doorhangers. - Context Menus. - Modals. Most user interface elements are listed in the meta bug. Mozilla plans to release the new design in Firefox 89; the browser is scheduled for a mid-2021 release. Its release date is set to May 18, 2021... [Developer/Firefox extension author] Sören Hentzschel revealed that he saw some of the Firefox Proton mockups... He notes that Firefox will look more modern when the designs land and that Mozilla plans to introduce useful improvements, especially in regards to the user experience. Hentzschel mentions two examples of potential improvements to the user experience: a mockup that displays vertical tabs in a compact mode, and another that shows the grouping of tabs on the tab bar.' -- source: https://news.slashdot.org/story/21/01/03/0516247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blender At Cannes
by Lawrence D'Oliveiro 01 Jan '21

01 Jan '21

Just found out about this French-made animation <https://en.wikipedia.org/wiki/I_Lost_My_Body> which was shown at Cannes 2019, and won the “Nespresso Grand Prize”. I mention it because its trivia page at IMDb <https://www.imdb.com/title/tt9806192/trivia> says “Created using the free open-source software Blender”. Note that it is not a typical 3D graphics animation: it is (mostly) drawn/rendered in a style that looks like traditional 2D cel animation. Blender has a feature called the “Grease Pencil” that lets you combine 3D and 2D-style art into the same workflow. This goes beyond simple “toon shaders” as found in other 3D software, to actually let you draw brushstrokes in 3D space, as geometric objects in their own right.

1 0

Should Intel Stop Making Chips?
by Lawrence D'Oliveiro 01 Jan '21

01 Jan '21

Intel has suffered more than one misstep in its recent attempts to move to more advanced chip-fabrication technologies. Performance-wise, AMD has been eating its breakfast. RISC-based alternative architectures like ARM and RISC-V are eating into the x86 market. Now an investor fund <https://arstechnica.com/gadgets/2020/12/activist-hedge-fund-advises-intel-t…> is suggesting that Intel outsource its chip-making facilities altogether (like AMD did years ago). This part was news to me: “Intel has lost some $60 billion in market value over the past year...”. According to Yahoo Finance <https://finance.yahoo.com/quote/INTC/>, its current market cap is just a bit over $200 billion. So that $60 billion represents a huge drop in its share price.

1 0

Mastodon Versus Gab
by Lawrence D'Oliveiro 29 Dec '20

29 Dec '20

(OK, this is an old article, but I just noticed it.) Mastodon is not a social network, but a “federation” of social networks. It is built on open-source protocols and software, which you can use to set up your own social-network node. You can then become part of the “fediverse” by associating with other Mastodon nodes, allowing users of one to interact with users of another. What is allowed on a node is entirely up the policies of the node admins. The Fediverse is intentionally decentralized, and admins of one node do not have the power to control what users do on another node. Contrast this with traditional social-networking sites like Facebook and Twitter, each of which is controlled by a single company. Naturally, such autonomy is a double-edged sword. So what do you do when the neo-Nazis move in? Gab, home of those who have promoted violence against various groups based on ethnicity, sexuality etc, is now a Mastodon node. How is the rest of the Fediverse dealing with them? The answer seems to be: you can’t stop them operating, but you can shun them. <https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-n…>

1 0

Linux Kernel Ported to the Nintendo 64
by Peter Reutemann 29 Dec '20

29 Dec '20

'Phoronix reports: It's been a turbulent year and 2020 is certainly ending interesting in the Linux/open-source space... If it wasn't odd enough seeing Sony providing a new official Linux driver for their PlayStation 5 DualSense controller for ending out the year, there is also a new Linux port to the Nintendo 64 game console... Yes, a brand new port to the game console that launched more than two decades ago. Open-source developer Lauri Kasanen who has contributed to Mesa and the Linux graphics stack took to developing a new Nintendo 64 port and announced it this Christmas day. This isn't the first time Linux has been ported to the N64 but prior attempts weren't aimed at potentially upstreaming it into the mainline Linux kernel... This fresh port to the N64 was pursued in part to help port emulators and frame-buffer or console games. And also, the announcement adds, "Most importantly, because I can."' -- source: https://linux.slashdot.org/story/20/12/28/0024241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Let’s Encrypt comes up with workaround for abandonware Android devices
by Peter Reutemann 29 Dec '20

29 Dec '20

'Things were touch-and-go for a while, but it looks like Let's Encrypt's transition to a standalone certificate authority (CA) isn't going to break a ton of old Android phones. This was a serious concern earlier due to an expiring root certificate, but Let's Encrypt has come up with a workaround. Let's Encrypt is a fairly new certificate authority, but it's also one of the world's leading. The service was a major player in the push to make the entire Web run over HTTPS, and as a free, open issuing authority, it went from zero certs to one billion certs in just four years. For regular users, the list of trusted CAs is usually issued by your operating system or browser vendor, so any new CA has a long rollout that involves getting added to the list of trusted CAs by every OS and browser on Earth as well as getting updates to every user. To get up and running quickly, Let's Encrypt got a cross-signature from an established CA, IdenTrust, so any browser or OS that trusted IdenTrust could now trust Let's Encrypt, and the service could start issuing useful certs. When it launched in 2016, Let's Encrypt also issued its own root certificate ("ISRG Root X1") and applied for it to be trusted by the major software platforms, most of which accepted it sometime that year. Now, several years later, with IdenTrust's "DST Root X3" certificate set to expire in September 2021, the time has come for Let's Encrypt to stand on its own and rely on its own root certificate. Since this was submitted four years ago, surely every Web-capable OS currently in use has gotten an update with Let's Encrypt's cert, right? That's true of every mainstream OS except for one. Sitting in the corner of the room, wearing a dunce cap, is Android, the world's only major consumer operating system that can't be centrally updated by its creator. Believe it or not, there are still quite a lot of people running a version of Android that hasn't been updated in four years. Let's Encrypt says it was added to Android's CA store in version 7.1.1 (released December 2016) and, according to Google's official stats, 33.8 percent of active Android users are on a version older than that. Given Android's 2.5 billion strong monthly active user base, that's 845 million people who have a root store frozen in 2016. Oh no.' -- source: https://arstechnica.com/gadgets/2020/12/lets-encrypt-comes-up-with-workarou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Websites That Won’t Let Go
by Lawrence D'Oliveiro 26 Dec '20

26 Dec '20

A friend asked me for help, saying some kind of “gambling app” had managed to attach itself to his Android phone, and kept popping up all the time. I figured he had been tricked into installing something, and we would probably have to track down the app, which likely had some innocuous name to obscure its purpose. Or possibly even worse, it had managed to take advantage of some vulnerability in his OS version to hide itself. Turned out it was a bit simpler than that. It was a website he had visited in Chrome (most likely following a link from an ad or something), which had an interesting technique to prevent him from getting away: it kept pestering him to allow it to access his location data. The trick was, it had maybe a hundred (maybe more) different site names of the form “«nn».example.com”, so when you blocked one, it would simply ask again, the request coming from a different number for «nn». The expectation obviously was that the user would eventually give up and allow one of these sites access. I was able to close the offending tab, but on quitting and restarting Chrome, it would come back. I figured out that his Chrome setting was to restore the last-visited page(s) when Chrome was restarted, which was why this page kept coming up. So I just turned off that setting. I thought maybe there was some deeper malware that would just bring the problem back when that setting was restored, and that he should consult somebody expert on more recent versions of Android to see about a permanent fix. But he suggested re-enabling that setting, just to confirm the problem was still there. And I did. And it wasn’t! So there was no obvious sign of any malware installation, it was just the website itself, exploiting a quirk of browser behaviour, to gain a lock on the user and blackmail them into giving up their location data.

1 0